109 lines
No EOL
3.6 KiB
Text
109 lines
No EOL
3.6 KiB
Text
Title:
|
||
======
|
||
OSCommerce v3.0.2 - Persistent Cross Site Vulnerability
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-02-02
|
||
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
407
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
osCommerce is the leading Open Source online shop e-commerce solution that is available for free under the
|
||
GNU General Public License. It features a rich set of out-of-the-box online shopping cart functionality that
|
||
allows store owners to setup, run, and maintain their online stores with minimum effort and with no costs,
|
||
license fees, or limitations involved.
|
||
The goal of the osCommerce project is to continually evolve by attracting a community that supports the ongoing
|
||
development of the project at its core level and extensively through contributions to provide additional
|
||
functionality to the already existing rich feature set.
|
||
Everything you need to get started in selling physical and digital goods over the internet, from the Catalog frontend
|
||
that is presented to your customers, to the Administration Tool backend that completely handles your products,
|
||
customers, orders, and online store data.
|
||
|
||
(Copy of the Vendor Homepage: http://www.opensourcecms.com/scripts/details.php?scriptid=94&name=osCommerce)
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
Vulnerability-Lab Team (F0x) discovered a persistent Cross Site Scripting Vulnerability on the OSCommerce Shop Software.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-02-02: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Medium
|
||
|
||
|
||
Details:
|
||
========
|
||
Multiple persistant cross site vulnerabilities are detected on the OSCommerce v3.0.2.
|
||
The bug allows remote attacker to implement malicious script code on the application side.
|
||
Successful exploitation of the vulnerability allows an attacker to manipulate specific modules & can
|
||
lead to session hijacking (user/mod/admin).
|
||
|
||
Vulnerable Module(s):
|
||
[+]index.php?Cart
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The vulnerability can be exploited by local low privileged user account with required medium user inter action. For demonstration or reproduce ...
|
||
|
||
PoC:
|
||
"'><img src=vul onerror=alert('vulnerabilitylab')> in the "front" field of the shirt module.
|
||
|
||
Output:
|
||
Size: Medium<br/>- Front: "'><img src=vul onerror=alert('vulnerabilitylab')>
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the persistent vulnerability is estimated as medium.
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Research Laboratory - Alexander Fuchs (F0x23)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-
|
||
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of
|
||
other media, are reserved by Vulnerability-Lab or its suppliers.
|
||
|
||
Copyright <20> 2012|Vulnerability-Lab
|
||
|
||
|
||
--
|
||
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com
|
||
Contact: admin@vulnerability-lab.com or support@vulnerability-lab.com |